⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 207985 in webkit


Ignore:
Timestamp:
Oct 27, 2016, 3:56:19 AM (10 years ago)
Author:
Carlos Garcia Campos
Message:

Merge r207804 - Do not update selection rect on dirty lineboxes.
​https://bugs.webkit.org/show_bug.cgi?id=163862
<rdar://problem/28813156>

Reviewed by Simon Fraser.

Source/WebCore:

In certain cases RenderBlock::updateFirstLetter() triggers
unwanted render tree mutation while the caller assumes intact renderers.
This patch ensures that no renderers gets destroyed while computing the preferred widths
when we are outside of layout context.

Test: fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html

  • rendering/RenderBlock.cpp:

(WebCore::RenderBlock::computePreferredLogicalWidths):
(WebCore::RenderBlock::updateFirstLetter):

  • rendering/RenderBlock.h:
  • rendering/RenderListItem.cpp:

(WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):

  • rendering/RenderRubyRun.cpp:

(WebCore::RenderRubyRun::updateFirstLetter):

  • rendering/RenderRubyRun.h:
  • rendering/RenderTable.cpp:

(WebCore::RenderTable::updateFirstLetter):

  • rendering/RenderTable.h:
  • rendering/svg/RenderSVGText.cpp:

(WebCore::RenderSVGText::updateFirstLetter):

  • rendering/svg/RenderSVGText.h:

LayoutTests:

  • fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt: Added.
  • fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html: Added.
Location:
releases/WebKitGTK/webkit-2.14
Files:
2 added
11 edited

Legend:

Unmodified
Added
Removed

  • releases/WebKitGTK/webkit-2.14/LayoutTests/ChangeLog

    r207984 r207985  
     12016-10-24  Zalan Bujtas  <zalan@apple.com>
     2
     3        Do not update selection rect on dirty lineboxes.
     4        https://bugs.webkit.org/show_bug.cgi?id=163862
     5        <rdar://problem/28813156>
     6
     7        Reviewed by Simon Fraser.
     8
     9        * fast/css-generated-content/dynamic-first-letter-selection-clear-crash-expected.txt: Added.
     10        * fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html: Added.
     11
    1122016-10-21  Zalan Bujtas  <zalan@apple.com>
    213

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog

    r207984 r207985  
     12016-10-24  Zalan Bujtas  <zalan@apple.com>
     2
     3        Do not update selection rect on dirty lineboxes.
     4        https://bugs.webkit.org/show_bug.cgi?id=163862
     5        <rdar://problem/28813156>
     6
     7        Reviewed by Simon Fraser.
     8
     9        In certain cases RenderBlock::updateFirstLetter() triggers
     10        unwanted render tree mutation while the caller assumes intact renderers.
     11        This patch ensures that no renderers gets destroyed while computing the preferred widths
     12        when we are outside of layout context.
     13
     14        Test: fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html
     15
     16        * rendering/RenderBlock.cpp:
     17        (WebCore::RenderBlock::computePreferredLogicalWidths):
     18        (WebCore::RenderBlock::updateFirstLetter):
     19        * rendering/RenderBlock.h:
     20        * rendering/RenderListItem.cpp:
     21        (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
     22        * rendering/RenderRubyRun.cpp:
     23        (WebCore::RenderRubyRun::updateFirstLetter):
     24        * rendering/RenderRubyRun.h:
     25        * rendering/RenderTable.cpp:
     26        (WebCore::RenderTable::updateFirstLetter):
     27        * rendering/RenderTable.h:
     28        * rendering/svg/RenderSVGText.cpp:
     29        (WebCore::RenderSVGText::updateFirstLetter):
     30        * rendering/svg/RenderSVGText.h:
     31
    1322016-10-21  Zalan Bujtas  <zalan@apple.com>
    233

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.cpp

    r207100 r207985  
    27592759    ASSERT(preferredLogicalWidthsDirty());
    27602760
    2761     updateFirstLetter();
     2761    // FIXME: Do not even try to reshuffle first letter renderers when we are not in layout
     2762    // until after webkit.org/b/163848 is fixed.
     2763    updateFirstLetter(view().frameView().isInRenderTreeLayout() ? RenderTreeMutationIsAllowed::Yes : RenderTreeMutationIsAllowed::No);
    27622764
    27632765    m_minPreferredLogicalWidth = 0;
    … …  
    33093311}
    33103312
    3311 void RenderBlock::updateFirstLetter()
     3313void RenderBlock::updateFirstLetter(RenderTreeMutationIsAllowed mutationAllowedOrNot)
    33123314{
    33133315    RenderObject* firstLetterObj;
    … …  
    33303332        return;
    33313333
     3334    if (mutationAllowedOrNot != RenderTreeMutationIsAllowed::Yes)
     3335        return;
    33323336    // Our layout state is not valid for the repaints we are going to trigger by
    33333337    // adding and removing children of firstLetterContainer.

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderBlock.h

    r205614 r207985  
    244244    LayoutUnit collapsedMarginAfterForChild(const RenderBox& child) const;
    245245
    246     virtual void updateFirstLetter();
     246    enum class RenderTreeMutationIsAllowed { Yes, No };
     247    virtual void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes);
    247248    void getFirstLetter(RenderObject*& firstLetter, RenderElement*& firstLetterContainer, RenderObject* skipObject = nullptr);
    248249

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderListItem.cpp

    r207984 r207985  
    269269        return;
    270270
    271     // FIXME: Do not even try reposition the marker when we are not in layout
     271    // FIXME: Do not even try to reposition the marker when we are not in layout
    272272    // until after we fixed webkit.org/b/163789.
    273273    if (!view().frameView().isInRenderTreeLayout())

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.cpp

    r203660 r207985  
    102102}
    103103
    104 void RenderRubyRun::updateFirstLetter()
     104void RenderRubyRun::updateFirstLetter(RenderTreeMutationIsAllowed)
    105105{
    106106}

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderRubyRun.h

    r203660 r207985  
    6161
    6262    RenderBlock* firstLineBlock() const override;
    63     void updateFirstLetter() override;
     63    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
    6464
    6565    void getOverhang(bool firstLine, RenderObject* startRenderer, RenderObject* endRenderer, float& startOverhang, float& endOverhang) const;

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.cpp

    r203708 r207985  
    14591459}
    14601460
    1461 void RenderTable::updateFirstLetter()
     1461void RenderTable::updateFirstLetter(RenderTreeMutationIsAllowed)
    14621462{
    14631463}

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/RenderTable.h

    r203708 r207985  
    304304
    305305    RenderBlock* firstLineBlock() const final;
    306     void updateFirstLetter() final;
     306    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) final;
    307307   
    308308    void updateLogicalWidth() final;

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.cpp

    r201635 r207985  
    546546// Fix for <rdar://problem/8048875>. We should not render :first-letter CSS Style
    547547// in a SVG text element context.
    548 void RenderSVGText::updateFirstLetter()
    549 {
    550 }
    551 
    552 }
     548void RenderSVGText::updateFirstLetter(RenderTreeMutationIsAllowed)
     549{
     550}
     551
     552}

  • releases/WebKitGTK/webkit-2.14/Source/WebCore/rendering/svg/RenderSVGText.h

    r201704 r207985  
    9393
    9494    RenderBlock* firstLineBlock() const override;
    95     void updateFirstLetter() override;
     95    void updateFirstLetter(RenderTreeMutationIsAllowed = RenderTreeMutationIsAllowed::Yes) override;
    9696
    9797    bool shouldHandleSubtreeMutations() const;
Note: See TracChangeset for help on using the changeset viewer.